Knowledge Management

Safe time to add an index

Contributor

I was searching through the documentation but did not find anything on this. I was looking to create an index but I see on the indexes page it says it could trigger a rolling restart for some actions. Does this include creating a new index? The link on the page brings me to general help, not anything specific. I did not see anything when looking through the documentation either.

0 Karma
1 Solution

Super Champion

Hi @aohls,

Look here for changes that require a rolling restart for the indexer cluster :
https://docs.splunk.com/Documentation/Splunk/7.3.1/Indexer/Updatepeerconfigurations#Restart_or_reloa...

And here for index configuration changes :
https://docs.splunk.com/Documentation/Splunk/7.3.1/Indexer/Determinerestart

As you can see adding a new index does not require a restart :

You do not need to restart the indexer if you only make these changes:

Adding new index stanzas.

Cheers,
David

View solution in original post

Super Champion

Hi @aohls,

Look here for changes that require a rolling restart for the indexer cluster :
https://docs.splunk.com/Documentation/Splunk/7.3.1/Indexer/Updatepeerconfigurations#Restart_or_reloa...

And here for index configuration changes :
https://docs.splunk.com/Documentation/Splunk/7.3.1/Indexer/Determinerestart

As you can see adding a new index does not require a restart :

You do not need to restart the indexer if you only make these changes:

Adding new index stanzas.

Cheers,
David

View solution in original post

Contributor

Thanks @DavidHourani this is helpful to know.

0 Karma

Super Champion

You're welcome !

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes and swag!